Skip to content

When user has 2FA enabled do not attempt OAuth password auth

Drew Blessing requested to merge dblessing_shortcircuit_oauth_auth_when_2fa_present into master

What does this MR do and why?

When user has 2FA enabled, do not attempt OAuth password auth.

When 2FA is enabled for a user we do not allow password credential flow with OAuth. Instead a user must use a personal access token to authenticate directly with the API. This change ensures that we never attempt password auth if a user has 2FA enabled.

We already had a check that would fail auth if a user had 2FA enabled, but this check came after password comparison happens and counter is incremented. This change flips the logic to check 2FA first.

Relates to https://gitlab.com/gitlab-sirt/shared-incidents/incident_4326/-/issues/1

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Adil Farrukh

Merge request reports